The invention relates to a method of performing user authentication in a network system (10) that comprises a client (22) in communication via a first network (14) with a server infrastructure (16) including an entrance point of a second network and an application server in the second network. The client (22) has access via a user-controllable card reader (24) to a smart card (26). A first authentication key is associated with the smart card (26) and a second authentication key is associated with the card reader (24). In a first step user authentication is performed in context with an encryption process between the client (22) and the server infrastructure (16) using the first authentication key. A second user authentication step is performed between the client (22) and the application server using both the first authentication key and the second authentication key. Data authentication (secure signing) can be performed in addition to the user authentication described above.